Add support to fastboot using virtual addresses.

Change-Id: Iee873f4eb3dc3d136ec9430d41262802d3d394c5
diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index f6d6e50..701095a 100644
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -366,12 +366,14 @@
 	ptr = atag_end(ptr);
 }
 
+typedef void entry_func_ptr(unsigned, unsigned, unsigned*);
 void boot_linux(void *kernel, unsigned *tags,
 		const char *cmdline, unsigned machtype,
 		void *ramdisk, unsigned ramdisk_size)
 {
 	int ret = 0;
-	void (*entry)(unsigned, unsigned, unsigned*) = kernel;
+	void (*entry)(unsigned, unsigned, unsigned*) = (entry_func_ptr*)(PA((addr_t)kernel));
+	uint32_t tags_phys = platform_get_virt_to_phys_mapping((addr_t)tags);
 
 #if DEVICE_TREE
 	/* Update the Device Tree */
@@ -399,7 +401,8 @@
 #if ARM_WITH_MMU
 	arch_disable_mmu();
 #endif
-	entry(0, machtype, tags);
+
+	entry(0, machtype, (unsigned*)tags_phys);
 }
 
 unsigned page_size = 0;
@@ -425,7 +428,6 @@
 	unsigned ramdisk_actual;
 	unsigned imagesize_actual;
 	unsigned second_actual = 0;
-	unsigned dt_actual = 0;
 
 #if DEVICE_TREE
 	struct dt_table *table;
@@ -471,6 +473,11 @@
 		page_mask = page_size - 1;
 	}
 
+	/* Get virtual addresses since the hdr saves physical addresses. */
+	hdr->kernel_addr = VA((addr_t)(hdr->kernel_addr));
+	hdr->ramdisk_addr = VA((addr_t)(hdr->ramdisk_addr));
+	hdr->tags_addr = VA((addr_t)(hdr->tags_addr));
+
 	/* Authenticate Kernel */
 	if(target_use_signed_kernel() && (!device.is_unlocked) && (!device.is_tampered))
 	{
@@ -703,6 +710,11 @@
 		return -1;
 	}
 
+	/* Get virtual addresses since the hdr saves physical addresses. */
+	hdr->kernel_addr = VA(hdr->kernel_addr);
+	hdr->ramdisk_addr = VA(hdr->ramdisk_addr);
+	hdr->tags_addr = VA(hdr->tags_addr);
+
 	/* Authenticate Kernel */
 	if(target_use_signed_kernel() && (!device.is_unlocked) && (!device.is_tampered))
 	{
@@ -1048,7 +1060,9 @@
 		}
 
 		/* Read device device tree in the "tags_add */
-		memmove((void*) hdr->tags_addr, boot_image_start + dt_image_offset +  dt_entry_ptr->offset, dt_entry_ptr->size);
+		memmove((void*) hdr->tags_addr,
+				boot_image_start + dt_image_offset +  dt_entry_ptr->offset,
+				dt_entry_ptr->size);
 	}
 
 	/* Everything looks fine. Return success. */
@@ -1060,7 +1074,7 @@
 {
 	unsigned kernel_actual;
 	unsigned ramdisk_actual;
-	static struct boot_img_hdr hdr;
+	struct boot_img_hdr *hdr;
 	char *ptr = ((char*) data);
 
 	if (sz < sizeof(hdr)) {
@@ -1068,18 +1082,23 @@
 		return;
 	}
 
-	memcpy(&hdr, data, sizeof(hdr));
+	hdr = (struct boot_img_hdr *)data;
 
 	/* ensure commandline is terminated */
-	hdr.cmdline[BOOT_ARGS_SIZE-1] = 0;
+	hdr->cmdline[BOOT_ARGS_SIZE-1] = 0;
 
-	if(target_is_emmc_boot() && hdr.page_size) {
-		page_size = hdr.page_size;
+	if(target_is_emmc_boot() && hdr->page_size) {
+		page_size = hdr->page_size;
 		page_mask = page_size - 1;
 	}
 
-	kernel_actual = ROUND_TO_PAGE(hdr.kernel_size, page_mask);
-	ramdisk_actual = ROUND_TO_PAGE(hdr.ramdisk_size, page_mask);
+	kernel_actual = ROUND_TO_PAGE(hdr->kernel_size, page_mask);
+	ramdisk_actual = ROUND_TO_PAGE(hdr->ramdisk_size, page_mask);
+
+	/* Get virtual addresses since the hdr saves physical addresses. */
+	hdr->kernel_addr = VA(hdr->kernel_addr);
+	hdr->ramdisk_addr = VA(hdr->ramdisk_addr);
+	hdr->tags_addr = VA(hdr->tags_addr);
 
 	/* sz should have atleast raw boot image */
 	if (page_size + kernel_actual + ramdisk_actual > sz) {
@@ -1099,12 +1118,12 @@
 	fastboot_okay("");
 	udc_stop();
 
-	memmove((void*) hdr.ramdisk_addr, ptr + page_size + kernel_actual, hdr.ramdisk_size);
-	memmove((void*) hdr.kernel_addr, ptr + page_size, hdr.kernel_size);
+	memmove((void*) hdr->ramdisk_addr, ptr + page_size + kernel_actual, hdr->ramdisk_size);
+	memmove((void*) hdr->kernel_addr, ptr + page_size, hdr->kernel_size);
 
-	boot_linux((void*) hdr.kernel_addr, (void*) hdr.tags_addr,
-		   (const char*) hdr.cmdline, board_machtype(),
-		   (void*) hdr.ramdisk_addr, hdr.ramdisk_size);
+	boot_linux((void*) hdr->kernel_addr, (void*) hdr->tags_addr,
+		   (const char*) hdr->cmdline, board_machtype(),
+		   (void*) hdr->ramdisk_addr, hdr->ramdisk_size);
 }
 
 void cmd_erase(const char *arg, void *data, unsigned sz)
diff --git a/app/aboot/fastboot.c b/app/aboot/fastboot.c
index 2b699b3..ee11a13 100644
--- a/app/aboot/fastboot.c
+++ b/app/aboot/fastboot.c
@@ -29,6 +29,7 @@
 #include <debug.h>
 #include <string.h>
 #include <stdlib.h>
+#include <platform.h>
 #include <kernel/thread.h>
 #include <kernel/event.h>
 #include <dev/udc.h>
@@ -147,7 +148,7 @@
 
 	while (len > 0) {
 		xfer = (len > MAX_USBFS_BULK_SIZE) ? MAX_USBFS_BULK_SIZE : len;
-		req->buf = buf;
+		req->buf = PA((addr_t)buf);
 		req->length = xfer;
 		req->complete = req_complete;
 		r = udc_request_queue(out, req);
@@ -184,7 +185,7 @@
 	if (fastboot_state == STATE_ERROR)
 		goto oops;
 
-	req->buf = buf;
+	req->buf = PA((addr_t)buf);
 	req->length = len;
 	req->complete = req_complete;
 	r = udc_request_queue(in, req);
diff --git a/include/platform.h b/include/platform.h
old mode 100755
new mode 100644
diff --git a/platform/msm_shared/bam.c b/platform/msm_shared/bam.c
index 0903c9d..3ed2be9 100644
--- a/platform/msm_shared/bam.c
+++ b/platform/msm_shared/bam.c
@@ -1,17 +1,17 @@
-/* Copyright (c) 2012, Code Aurora Forum. All rights reserved.
-
+/* Copyright (c) 2012, The Linux Foundation. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- *   * Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- *   * Redistributions in binary form must reproduce the above
- *     copyright notice, this list of conditions and the following
- *     disclaimer in the documentation and/or other materials provided
- *     with the distribution.
- *   * Neither the name of Code Aurora Forum, Inc. nor the names of its
- *     contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
@@ -30,6 +30,7 @@
 #include <reg.h>
 #include <debug.h>
 #include <stdlib.h>
+#include <platform.h>
 #include <platform/interrupts.h>
 #include <platform/iomap.h>
 #include <platform/irqs.h>
@@ -192,7 +193,6 @@
 int bam_pipe_fifo_init(struct bam_instance *bam,
                        uint8_t pipe_num)
 {
-
 	if (bam->pipe[pipe_num].fifo.size > 0x7FFF)
 	{
 		dprintf(CRITICAL,
@@ -201,7 +201,7 @@
 	}
 
 	/* Check if fifo start is 8-byte alligned */
-	ASSERT(!((uint32_t)bam->pipe[pipe_num].fifo.head & 0x7));
+	ASSERT(!((uint32_t)PA((addr_t)bam->pipe[pipe_num].fifo.head & 0x7)));
 
 	/* Check if fifo size is a power of 2.
 	 * The circular fifo logic in lk expects this.
@@ -215,7 +215,10 @@
 		BAM_P_FIFO_SIZESn(bam->pipe[pipe_num].pipe_num, bam->base));
 
 	/* Write descriptors FIFO base addr must be 8-byte aligned */
-	writel((uint32_t)bam->pipe[pipe_num].fifo.head,
+	/* Needs a physical address conversion as we are setting up
+	 * the base of the FIFO for the BAM state machine.
+	 */
+	writel((uint32_t)PA((addr_t)bam->pipe[pipe_num].fifo.head),
 		BAM_P_DESC_FIFO_ADDRn(bam->pipe[pipe_num].pipe_num, bam->base));
 
 	/* Initialize FIFO offset for the first read */
@@ -232,8 +235,6 @@
 void bam_sys_pipe_init(struct bam_instance *bam,
                        uint8_t pipe_num)
 {
-	uint32_t val = 0;
-
 	/* Reset the pipe to be allocated */
 	bam_pipe_reset(bam, pipe_num);
 
diff --git a/platform/msm_shared/hsusb.c b/platform/msm_shared/hsusb.c
index d8643f0..9dcc550 100644
--- a/platform/msm_shared/hsusb.c
+++ b/platform/msm_shared/hsusb.c
@@ -2,35 +2,38 @@
  * Copyright (c) 2008, Google Inc.
  * All rights reserved.
  *
- * Copyright (c) 2009-2012, Code Aurora Forum. All rights reserved.
+ * Copyright (c) 2009-2012, The Linux Foundation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of The Linux Foundation nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+ * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include <string.h>
 #include <stdlib.h>
 #include <debug.h>
+#include <platform.h>
 #include <platform/iomap.h>
 #include <platform/irqs.h>
 #include <platform/interrupts.h>
@@ -281,7 +284,7 @@
 					  sizeof(struct ept_queue_head));
 	arch_clean_invalidate_cache_range((addr_t) ept->req,
 					  sizeof(struct usb_request));
-	arch_clean_invalidate_cache_range((addr_t) req->req.buf,
+	arch_clean_invalidate_cache_range((addr_t) VA(req->req.buf),
 					  req->req.length);
 	arch_clean_invalidate_cache_range((addr_t) ept->req->item,
 					  sizeof(struct ept_queue_item));
@@ -328,7 +331,7 @@
 		}
 		while (readl(&(item->info)) & INFO_ACTIVE);
 
-		arch_clean_invalidate_cache_range((addr_t) req->req.buf,
+		arch_clean_invalidate_cache_range(VA((addr_t) req->req.buf),
 						  req->req.length);
 
 		if (item->info & 0xff) {
@@ -423,6 +426,7 @@
 {
 	DBG("setup_tx %p %d\n", buf, len);
 	memcpy(ep0req->buf, buf, len);
+	ep0req->buf = PA((addr_t)ep0req->buf);
 	ep0req->complete = ep0in_complete;
 	ep0req->length = len;
 	udc_request_queue(ep0in, ep0req);
@@ -597,7 +601,7 @@
 	arch_clean_invalidate_cache_range((addr_t) epts,
 					  32 * sizeof(struct ept_queue_head));
 
-	writel((unsigned)epts, USB_ENDPOINTLISTADDR);
+	writel((unsigned)PA((addr_t)epts), USB_ENDPOINTLISTADDR);
 
 	/* select DEVICE mode */
 	writel(0x02, USB_USBMODE);
diff --git a/platform/msm_shared/qpic_nand.c b/platform/msm_shared/qpic_nand.c
index fd9c388..6bb1f27 100644
--- a/platform/msm_shared/qpic_nand.c
+++ b/platform/msm_shared/qpic_nand.c
@@ -34,6 +34,7 @@
 #include <string.h>
 #include <malloc.h>
 #include <sys/types.h>
+#include <platform.h>
 #include <platform/clock.h>
 
 static uint32_t nand_base;
@@ -57,6 +58,8 @@
 static struct bam_instance bam;
 static uint8_t *bbtbl;
 
+static uint8_t* rdwr_buf;
+
 static struct flash_id supported_flash[] = {
 	/* Flash ID     ID Mask Density(MB)  Wid Pgsz   Blksz   oobsz onenand   Manuf */
 	{0x1590aa2c, 0xFFFFFFFF, (256 << 20), 0, 2048, (2048 << 6), 64, 0, 0},	/*Micr */
@@ -110,12 +113,12 @@
 {
 	uint32_t val;
 
-	bam_add_cmd_element(cmd_list_ptr, reg_addr,	(uint32_t)&val, CE_READ_TYPE);
+	bam_add_cmd_element(cmd_list_ptr, reg_addr, (uint32_t)PA((addr_t)&val), CE_READ_TYPE);
 
 	/* Enqueue the desc for the above command */
 	bam_add_one_desc(&bam,
 					 CMD_PIPE_INDEX,
-					 (unsigned char*)cmd_list_ptr,
+					 (unsigned char*)PA((addr_t)cmd_list_ptr),
 					 BAM_CE_SIZE,
 					 BAM_DESC_CMD_FLAG| BAM_DESC_INT_FLAG | flags);
 
@@ -148,7 +151,7 @@
 	bam_add_one_desc(&bam,
 					 CMD_PIPE_INDEX,
 					 (unsigned char*)cmd_list_ptr_start,
-					 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+					 PA((uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 					 BAM_DESC_LOCK_FLAG | BAM_DESC_INT_FLAG |
 					 BAM_DESC_NWD_FLAG | BAM_DESC_CMD_FLAG);
 
@@ -340,7 +343,7 @@
 	bam_add_one_desc(&bam,
 					 CMD_PIPE_INDEX,
 					 (unsigned char*)cmd_list_ptr_start,
-					 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+					 PA((addr_t)(uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 					 desc_flags);
 
 	cmd_list_ptr_start = cmd_list_ptr;
@@ -349,7 +352,7 @@
 	/* Add Data desc */
 	bam_add_desc(&bam,
 				 DATA_PRODUCER_PIPE_INDEX,
-				 (unsigned char *)data_ptr,
+				 (unsigned char *)PA((addr_t)data_ptr),
 				 data_len,
 				 BAM_DESC_INT_FLAG);
 
@@ -391,7 +394,7 @@
 	bam_add_one_desc(&bam,
 					 CMD_PIPE_INDEX,
 					 (unsigned char*)cmd_list_ptr_start,
-					 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+					 PA((uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 					 BAM_DESC_UNLOCK_FLAG | BAM_DESC_CMD_FLAG| BAM_DESC_INT_FLAG);
 
 	qpic_nand_wait_for_cmd_exec(1);
@@ -658,7 +661,7 @@
 	flash_status_reset = NAND_FLASH_STATUS_RESET;
 	read_status_reset = NAND_READ_STATUS_RESET;
 
-	bam_add_cmd_element(cmd_list_ptr, NAND_FLASH_STATUS, (uint32_t)flash_status_read, CE_READ_TYPE);
+	bam_add_cmd_element(cmd_list_ptr, NAND_FLASH_STATUS, (uint32_t)PA((addr_t)flash_status_read), CE_READ_TYPE);
 	cmd_list_ptr++;
 	bam_add_cmd_element(cmd_list_ptr, NAND_FLASH_STATUS, (uint32_t)flash_status_reset, CE_WRITE_TYPE);
 	cmd_list_ptr++;
@@ -708,7 +711,7 @@
 	bam_add_one_desc(&bam,
 					 CMD_PIPE_INDEX,
 					 (unsigned char*)cmd_list_ptr_start,
-					 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+					 PA((uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 					 desc_flags);
 
 	num_desc++;
@@ -716,7 +719,7 @@
 	/* Add Data desc */
 	bam_add_desc(&bam,
 				 DATA_PRODUCER_PIPE_INDEX,
-				 (unsigned char *)bad_block,
+				 (unsigned char *)PA((addr_t)bad_block),
 				 4,
 				 BAM_DESC_INT_FLAG);
 
@@ -849,7 +852,7 @@
 	bam_add_one_desc(&bam,
 					 CMD_PIPE_INDEX,
 					 (unsigned char*)cmd_list_ptr_start,
-					 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+					 PA((uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 					 BAM_DESC_NWD_FLAG | BAM_DESC_CMD_FLAG | BAM_DESC_INT_FLAG | BAM_DESC_LOCK_FLAG);
 
 	cmd_list_ptr_start = cmd_list_ptr;
@@ -873,7 +876,7 @@
 	bam_add_one_desc(&bam,
 					 CMD_PIPE_INDEX,
 					 (unsigned char*)cmd_list_ptr_start,
-					 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+					 PA((uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 					 BAM_DESC_INT_FLAG | BAM_DESC_CMD_FLAG | BAM_DESC_UNLOCK_FLAG) ;
 
 	num_desc = 1;
@@ -926,7 +929,7 @@
 	bam_add_one_desc(&bam,
 					 CMD_PIPE_INDEX,
 					 (unsigned char*)cmd_list_ptr_start,
-					 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+					 PA((uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 					 BAM_DESC_CMD_FLAG | BAM_DESC_LOCK_FLAG);
 
 	num_desc++;
@@ -943,7 +946,7 @@
 		bam_add_one_desc(&bam,
 						 CMD_PIPE_INDEX,
 						 (unsigned char*)cmd_list_ptr_start,
-						 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+						 PA((uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 						 BAM_DESC_NWD_FLAG | BAM_DESC_CMD_FLAG);
 
 		num_desc++;
@@ -966,7 +969,7 @@
 		bam_add_one_desc(&bam,
 						 CMD_PIPE_INDEX,
 						 (unsigned char*)cmd_list_ptr_start,
-						 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+						 PA((uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 						 int_flag | BAM_DESC_CMD_FLAG);
 		num_desc++;
 	}
@@ -1013,7 +1016,7 @@
 			len = flash.cw_size;
 			flags |= BAM_DESC_EOT_FLAG;
 		}
-		bam_add_one_desc(&bam, DATA_CONSUMER_PIPE_INDEX, (unsigned char*)start, len, flags);
+		bam_add_one_desc(&bam, DATA_CONSUMER_PIPE_INDEX, (unsigned char*)PA(start), len, flags);
 		num_desc++;
 
 		if ((i == (flash.cws_per_page - 1)) && (cfg_mode == NAND_CFG))
@@ -1022,7 +1025,7 @@
 			start = (uint32_t)spareaddr;
 			len = (flash.cws_per_page << 2);
 			flags = BAM_DESC_EOT_FLAG | BAM_DESC_INT_FLAG;
-			bam_add_one_desc(&bam, DATA_CONSUMER_PIPE_INDEX, (unsigned char*)start, len, flags);
+			bam_add_one_desc(&bam, DATA_CONSUMER_PIPE_INDEX, (unsigned char*)PA(start), len, flags);
 			num_desc++;
 		}
 	}
@@ -1206,7 +1209,7 @@
 	}
 
 	/* Create a bad block table */
-	bbtbl = (unsigned int *)malloc(sizeof(uint8_t) * flash.num_blocks);
+	bbtbl = (uint8_t *) malloc(sizeof(uint8_t) * flash.num_blocks);
 
 	if (bbtbl == NULL)
 	{
@@ -1216,6 +1219,21 @@
 
 	for (i = 0; i < flash.num_blocks; i++)
 		bbtbl[i] = NAND_BAD_BLK_VALUE_NOT_READ;
+
+	/* Set aside contiguous memory for reads/writes.
+	 * This is needed as the BAM transfers only work with
+	 * physically contiguous buffers.
+	 * We will copy any data to be written/ to be read from
+	 * nand to this buffer and this buffer will be submitted to BAM.
+	 */
+	rdwr_buf = (uint8_t*) malloc(flash.page_size + flash.spare_size);
+
+	if (rdwr_buf == NULL)
+	{
+		dprintf(CRITICAL, "Failed to allocate memory for page reads or writes\n");
+		return;
+	}
+
 }
 
 unsigned
@@ -1334,14 +1352,14 @@
 			/* Add Data desc */
 			bam_add_one_desc(&bam,
 							 DATA_PRODUCER_PIPE_INDEX,
-							 (unsigned char *)buffer,
+							 (unsigned char *)PA((addr_t)buffer),
 							 ud_bytes_in_last_cw,
 							 0);
 			num_data_desc++;
 
 			bam_add_one_desc(&bam,
 							 DATA_PRODUCER_PIPE_INDEX,
-							 (unsigned char *)spareaddr,
+							 (unsigned char *)PA((addr_t)spareaddr),
 							 oob_bytes,
 							 BAM_DESC_INT_FLAG);
 			num_data_desc++;
@@ -1353,7 +1371,7 @@
 			/* Add Data desc */
 			bam_add_one_desc(&bam,
 							 DATA_PRODUCER_PIPE_INDEX,
-							 (unsigned char *)buffer,
+							 (unsigned char *)PA((addr_t)buffer),
 							 DATA_BYTES_IN_IMG_PER_CW,
 							 BAM_DESC_INT_FLAG);
 			num_data_desc++;
@@ -1377,7 +1395,7 @@
 	bam_add_one_desc(&bam,
 					 CMD_PIPE_INDEX,
 					 (unsigned char*)cmd_list_ptr_start,
-					 (uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start,
+					 PA((uint32_t)cmd_list_ptr - (uint32_t)cmd_list_ptr_start),
 					 BAM_DESC_NWD_FLAG | BAM_DESC_CMD_FLAG | BAM_DESC_INT_FLAG | BAM_DESC_LOCK_FLAG);
 	num_cmd_desc++;
 
@@ -1472,7 +1490,7 @@
 			return NANDC_RESULT_SUCCESS;
 		}
 
-		result = qpic_nand_read_page(page, image, (unsigned char *)spare);
+		result = qpic_nand_read_page(page, rdwr_buf, (unsigned char *)spare);
 
 		if (result == NANDC_RESULT_BAD_PAGE)
 		{
@@ -1489,6 +1507,9 @@
 			continue;
 		}
 
+		/* Copy the read page into correct location. */
+		memcpy(image, rdwr_buf, flash.page_size);
+
 		page++;
 		image += flash.page_size;
 		/* Copy spare bytes to image */
@@ -1505,8 +1526,6 @@
 int
 flash_erase(struct ptentry *ptn)
 {
-	uint32_t block = ptn->start;
-	uint32_t count = ptn->length;
 	int ret = 0;
 
 	ret = qpic_nand_blk_erase(ptn->start * flash.num_pages_per_blk);
@@ -1568,16 +1587,19 @@
 			}
 		}
 
+		memcpy(rdwr_buf, image, flash.page_size);
+
 		if (extra_per_page)
 		{
+			memcpy(rdwr_buf + flash.page_size, image + flash.page_size, extra_per_page);
 			r = qpic_nand_write_page(page,
 									 NAND_CFG,
-									 image,
-									 image + flash.page_size);
+									 rdwr_buf,
+									 rdwr_buf + flash.page_size);
 		}
 		else
 		{
-			r = qpic_nand_write_page(page, NAND_CFG, image, spare);
+			r = qpic_nand_write_page(page, NAND_CFG, rdwr_buf, spare);
 		}
 
 		if (r)